the-web-application-hackers-handbook

Chapter 11 n Attacking Application Logic 421
The Attack
The SQL injection defense works by doubling any quotation marks appearing
within user input, so that within each pair of quotes, the first quote acts as an
escape character to the second. However, the developers did not consider what
would happen to the sanitized input if it was then handed to the truncation
function.
Recall the SQL injection example in a login function in Chapter 9. Suppose
that the application doubles any single quotation marks contained in user input
and also then imposes a length limit on the data, truncating it to 128 characters.
Supplying this username:
admin’--
now results in the following query, which fails to bypass the login:
SELECT * FROM users WHERE username = ‘admin’’--’ and password = ‘’
However, if you submit a following username (containing 127 a’s followed
by a single quotation mark):
aaaaaaaa[...]aaaaaaaaaaa’
the application first doubles up the single quotation mark and then truncates the
string to 128 characters, returning your input to its original value. This results
in a database error, because you have injected an additional single quotation
mark into the query without fixing the surrounding syntax. If you now also
supply the password:
or 1=1--
the application performs the following query, which succeeds in bypassing the
login:
SELECT * FROM users WHERE username = ‘aaaaaaaa[...]aaaaaaaaaaa’’ and
password = ‘or 1=1--’
The doubled quotation mark at the end of the string of a’s is interpreted
as an escaped quotation mark and, therefore, as part of the query data. This
string effectively continues as far as the next single quotation mark, which
in the original query marked the start of the user-supplied password value.
Thus, the actual username that the database understands is the literal string
data shown here:
aaaaaaaa[...]aaaaaaaaaaa’and password =
Hence, whatever comes next is interpreted as part of the query itself and can
be crafted to interfere with the query logic.